4 ms·

Yes, GDPR is very clear until it's not. Tell me for example how would you respect the right to be forgotten for web server access logs? The information "IP x.y.

Yes, GDPR is very clear until it's not. Tell me for example how would you respect the right to be forgotten for web server access logs? The information "IP x.y.z requested /index.html at dd/mm/yyyy" is PII under GDPR. Meaning you have to a) declare that you are collecting it, b) be able to produce all data for the person using IP x.y.z upon request, and c) be able to delete all log rows relating to x.y.z when they ask you to. Unless you have built your system from ground up with this requirement in mind, chances are you are in breach of GDPR. > But not I also cross a red light on foot from time to time and I do not think it should be made legal. Regulations that leave a freedom what to prosecute are not bad by design. This is not comparable as private citizens are able to petition and sue under GDPR. Hence, there is no similar discretion of what actually gets prosecuted as for jaywalking. It would be comparable if I, as a driver of a vehicle, was able to take any jaywalker to court. Which would be indeed complete madness.

tomschwiha 4y ago
Couldn't you for log requests just delete them after 24 hours? So at least you don't need to care for the right to be forgotten. Or instantly sanitize the IP so its not identifyable. In which case is the IP address in the access log helpful?
- vesinisa 4y ago
  These are all valid and sensible solutions if you are building a greenfield system. But GDPR applies to all systems, even those that were build years before its inception and the developers of whose could not in a million years have imagined that one day some crazy bureaucrats would criminalize logging IPs. Now think about even a moderately sized enterprise, that runs gazillions of individual apps (in-house, vendor-provided and SaaS), and the work required to auditting all the places you need clean when you want to delete all logs containing one IP. And that's just one small aspect of becoming fully compliant, there are millions of other types of surprising data that can be PII, and hence a liability, under GDPR. Email and IM apps, like Slack, are another interesting conundrum. Under GDPR, a customer should be able to request that all emails and Slack messages that contain/discuss his/her personal information must be a) discoverable and b) erasable. How do you even begin to solve that is beyond me..
  - tomschwiha 4y ago
    I agree it can be hard to fully comply. But I believe we should try to adhere and value the information (read: the consumers or clients). For GDPR and any other law that enforce something on you, that it has to be reasonable for you to comply. So in my personal interpretation any data you provide and identifies should be auto deletable (a post linked to your account). If I post your PII and you request HN to delete it - they are required to delete it. I don't think GDPR is too crazy .. but some people try to scare others because they scare to change because of making less money, ..
matthewmacleod 4y ago
Tell me for example how would you respect the right to be forgotten for web server access logs? The information "IP x.y.z requested /index.html at dd/mm/yyyy" is PII under GDPR. Meaning you have to a) declare that you are collecting it, b) be able to produce all data for the person using IP x.y.z upon request, and c) be able to delete all log rows relating to x.y.z when they ask you to. Unless you have built your system from ground up with this requirement in mind, chances are you are in breach of GDPR. That’s actually very clear and a simple example that anybody with passing familiarity can answer - and specifically you do nothing, since there is no right to erasure in this case. The “right to be forgotten” only applies in specific circumstances, under article 17: https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/ You have a legitimate interest in keeping server logs, so your responsibility is basically to have a clear and justifiable policy for why you are storing it, store it securely and for a reasonable time, and to make subjects aware of all this. It’s way less complicated than you’re making out.
- jsmith45 4y ago
  Objections under Article 21(1) could require deletion under Article 17(1)(c), unless " the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject". This is an inversion of the rule for legitimate interest processing, where the processing is legal unless there is an overriding interests, rights, and freedoms by the data subject. Basically, in the middle ground where neither set of rights and interests clearly override the other, the controller can legally process, but can also be forced to delete via the objection mechanism. The fact that there is little clear guidance as to in what circumstances one set of interests, rights, or freedoms should override legitimate interests or vice versa, it does make this area of the law basically come down to somewhat arbitrary decisions of the relevant DPAs. Recital 47 seems to suggest that for the normal direction of overriding interests, most situations where the average person would not be surprised/annoyed if informed about this processing in the specific circumstances is likely to be be permissible. But with Art 21(1)'s reversed burden, the guidance is simply "It should be for the controller to demonstrate that its compelling legitimate interest overrides the interests or the fundamental rights and freedoms of the data subject." No guidance at all about how much or low little this differs from the what is permissible via Art 6(1)(f). Clearly some difference is intended since the wording is clearly reversed from Art 6(1)(f). It leaves legitimate interests processing (which is by far the one of the most common processing reasons, and probably is common than all the other lawful reasons combined) as basically a giant minefield until the DPAs have established enough "case law" (for lack of a better term) to make sufficiently clear how they balance these competing interests and rights and freedoms.
jsmith45 4y ago
> Tell me for example how would you respect the right to be forgotten for web server access logs? You don't, nor would you be required to, assuming those logs are being collected for a legitimate non-profiling interest, like detecting abuse, and are only kept for as long as reasonably necessary. Lets take a look at the cases in which right to be forgotten even applies: > the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; This would be fair enough if you are keeping the data for longer than necessary, but if you are doing so in such a scenario, you are almost certainly in violation in other ways. >the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing; Not consent based processing, so inapplicable. > the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2); 22(2) is direct marketing related so inapplicable. 21(1) is interesting. It allows for subjects to object to legitimate interest processing. The controller must cease processing (including storage based "processing") the data upon such objection "unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims". But it would not be hard to show that log data important for abuse prevention overrides the interests, rights, and freedoms of the subject here. We are talking about data that is almost certainly not particularly revealing or sensitive to the subject, with a relatively weak personal identifier (IP address), that is not publicly visible, that will automatically be deleted once it is too old to be relevant for such purposes. (probably after only one or two months). We are not talking about say a publicly available archived news article that mentions the street on which the subject lives or anything like that. >the personal data have been unlawfully processed; >the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject; Neither of these would be applicable. >the personal data have been collected in relation to the offer of information society services referred to in Article 8(1). Ok, if you are running a social network, or youtube or something, and the data subject is a child, but they are either over the age of 16, and under it, but had parents consent on their behalf, then technically these logs would fall under this bullet point, and would need to be deleted. Art 8(1) only applies to procesing by consent, but if such consent were given these logs would obviously be related to the offer of such services. This scenario is not really what was intended though, and is poor wording in the law. (The law has a lot of poor wording!). The idea here looks like it was supposed to be that Children's data processed by consent must be deleted if consent revoked, even if you still retain other legal grounds for that processing. Normally those other grounds would let you refuse to delete the data, but because ramifications of providing data under consent may be unclear to children, they get to revoke it more strongly than adults.

tomschwiha 4y ago

Couldn't you for log requests just delete them after 24 hours? So at least you don't need to care for the right to be forgotten. Or instantly sanitize the IP so its not identifyable. In which case is the IP address in the access log helpful?

vesinisa 4y ago
These are all valid and sensible solutions if you are building a greenfield system. But GDPR applies to all systems, even those that were build years before its inception and the developers of whose could not in a million years have imagined that one day some crazy bureaucrats would criminalize logging IPs. Now think about even a moderately sized enterprise, that runs gazillions of individual apps (in-house, vendor-provided and SaaS), and the work required to auditting all the places you need clean when you want to delete all logs containing one IP. And that's just one small aspect of becoming fully compliant, there are millions of other types of surprising data that can be PII, and hence a liability, under GDPR. Email and IM apps, like Slack, are another interesting conundrum. Under GDPR, a customer should be able to request that all emails and Slack messages that contain/discuss his/her personal information must be a) discoverable and b) erasable. How do you even begin to solve that is beyond me..
- tomschwiha 4y ago
  I agree it can be hard to fully comply. But I believe we should try to adhere and value the information (read: the consumers or clients). For GDPR and any other law that enforce something on you, that it has to be reasonable for you to comply. So in my personal interpretation any data you provide and identifies should be auto deletable (a post linked to your account). If I post your PII and you request HN to delete it - they are required to delete it. I don't think GDPR is too crazy .. but some people try to scare others because they scare to change because of making less money, ..

matthewmacleod 4y ago

Tell me for example how would you respect the right to be forgotten for web server access logs? The information "IP x.y.z requested /index.html at dd/mm/yyyy" is PII under GDPR. Meaning you have to a) declare that you are collecting it, b) be able to produce all data for the person using IP x.y.z upon request, and c) be able to delete all log rows relating to x.y.z when they ask you to. Unless you have built your system from ground up with this requirement in mind, chances are you are in breach of GDPR. That’s actually very clear and a simple example that anybody with passing familiarity can answer - and specifically you do nothing, since there is no right to erasure in this case. The “right to be forgotten” only applies in specific circumstances, under article 17: https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/ You have a legitimate interest in keeping server logs, so your responsibility is basically to have a clear and justifiable policy for why you are storing it, store it securely and for a reasonable time, and to make subjects aware of all this. It’s way less complicated than you’re making out.

jsmith45 4y ago
Objections under Article 21(1) could require deletion under Article 17(1)(c), unless " the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject". This is an inversion of the rule for legitimate interest processing, where the processing is legal unless there is an overriding interests, rights, and freedoms by the data subject. Basically, in the middle ground where neither set of rights and interests clearly override the other, the controller can legally process, but can also be forced to delete via the objection mechanism. The fact that there is little clear guidance as to in what circumstances one set of interests, rights, or freedoms should override legitimate interests or vice versa, it does make this area of the law basically come down to somewhat arbitrary decisions of the relevant DPAs. Recital 47 seems to suggest that for the normal direction of overriding interests, most situations where the average person would not be surprised/annoyed if informed about this processing in the specific circumstances is likely to be be permissible. But with Art 21(1)'s reversed burden, the guidance is simply "It should be for the controller to demonstrate that its compelling legitimate interest overrides the interests or the fundamental rights and freedoms of the data subject." No guidance at all about how much or low little this differs from the what is permissible via Art 6(1)(f). Clearly some difference is intended since the wording is clearly reversed from Art 6(1)(f). It leaves legitimate interests processing (which is by far the one of the most common processing reasons, and probably is common than all the other lawful reasons combined) as basically a giant minefield until the DPAs have established enough "case law" (for lack of a better term) to make sufficiently clear how they balance these competing interests and rights and freedoms.

jsmith45 4y ago

> Tell me for example how would you respect the right to be forgotten for web server access logs? You don't, nor would you be required to, assuming those logs are being collected for a legitimate non-profiling interest, like detecting abuse, and are only kept for as long as reasonably necessary. Lets take a look at the cases in which right to be forgotten even applies: > the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; This would be fair enough if you are keeping the data for longer than necessary, but if you are doing so in such a scenario, you are almost certainly in violation in other ways. >the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing; Not consent based processing, so inapplicable. > the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2); 22(2) is direct marketing related so inapplicable. 21(1) is interesting. It allows for subjects to object to legitimate interest processing. The controller must cease processing (including storage based "processing") the data upon such objection "unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims". But it would not be hard to show that log data important for abuse prevention overrides the interests, rights, and freedoms of the subject here. We are talking about data that is almost certainly not particularly revealing or sensitive to the subject, with a relatively weak personal identifier (IP address), that is not publicly visible, that will automatically be deleted once it is too old to be relevant for such purposes. (probably after only one or two months). We are not talking about say a publicly available archived news article that mentions the street on which the subject lives or anything like that. >the personal data have been unlawfully processed; >the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject; Neither of these would be applicable. >the personal data have been collected in relation to the offer of information society services referred to in Article 8(1). Ok, if you are running a social network, or youtube or something, and the data subject is a child, but they are either over the age of 16, and under it, but had parents consent on their behalf, then technically these logs would fall under this bullet point, and would need to be deleted. Art 8(1) only applies to procesing by consent, but if such consent were given these logs would obviously be related to the offer of such services. This scenario is not really what was intended though, and is poor wording in the law. (The law has a lot of poor wording!). The idea here looks like it was supposed to be that Children's data processed by consent must be deleted if consent revoked, even if you still retain other legal grounds for that processing. Normally those other grounds would let you refuse to delete the data, but because ramifications of providing data under consent may be unclear to children, they get to revoke it more strongly than adults.